OCTOBER-REVIEW-REVISIONS 1a: children hold no request socket #28

Scripts, the script engines' children and the terminal's shell can no longer ask the site process to publish or push. The children's router and its socket (site_process/child_routes.rs), lichen ask in the CLI and Lua's and Python's lichen.ask are deleted, along with the routes descriptor (ROUTES_FD, ROUTES_FD_VAR, LICHEN_ROUTES_FD, descriptor 4 in the script and terminal spawns), Origin::Child, ChildAsked and the editor's push_routes. The helper is still answered before any hook or main reads a mode. The prose in SANDBOX.md, README-extended.md and docs/SECURITY.md drops the children's socket.

---

OCTOBER-REVIEW-REVISIONS, subunit 1a. Plan: https://tangled.org/notplants-bot.bsky.social/lichen-orchestrator/blob/main/machine-docs/plans/OCTOBER-REVIEW-REVISIONS-2026-10-28.md

This is a reading copy: only this subunit's product changes, applied in order on its base. Nothing here is to be merged.

Source PRs on lichen.page.review (product), in order, with their original descriptions #

• #3382 s/752-orr-u1a-no-child-routes — ORR 1a: children hold no request socket (child_routes and lichen ask go)

  OCTOBER-REVIEW-REVISIONS unit 1a, product: children hold no request socket (A3). Scripts, the script engines' children and the terminal's shell can no longer ask the site process for a publish or a push.

  Deleted:

  • site_process/child_routes.rs, the children's router and its socket;
  • lichen ask (lichen-cli) and Lua's and Python's lichen.ask;
  • ROUTES_FD, ROUTES_FD_VAR and LICHEN_ROUTES_FD (and lichen-env's keep of it), and descriptor 4 in the script and terminal spawns (prepare_ordinary's routes, spawn_script_child's, the PTY's);
  • Origin::Child, ChildAsked, and git/editor.rs's push_routes.

  SCRIPT and TERMINAL keep their lists; changing them is unit 4. The helper dispatch's order is unchanged: the helper is answered before any hook or main reads a mode. SANDBOX.md, README-extended.md and docs/SECURITY.md's prose drop the children's socket.

  Its tests and the guard's re-pin are the paired tests PR, stacked on this one. Checks count at the tests tip.

Commits #

• 187718bf2 ORR 1a: orr-u1a-no-child-routes (#3382)

Count and shas #

count-product-code-lines 65a6666b093b..187718bf2d1b: NET -433 · counted +6 -439 · moved out of the counted set +0 · comment-only deletions flagged 19 · macros flagged 0 · tests-folder code flagged 0

Base 65a6666b093bf64341dd4ba5a5547c4340c03744 (tip of s/750-grp-u6-docs). Head 187718bf2d1b80397b6bb909f4b61e583e6f6a41. 26 files changed.

Check #

Every changed file is a file one of the product PRs changed, and each is identical at the head to the same file at the last product branch s/752-orr-u1a-no-child-routes.